Defect #43910
closed
Projects with the identifiers "autocomplete" or "bulk_destroy" cannot perform some operations
Description
Hello,
After creating au project with identifier "autocomplete", loading https://<my-redmine-instance>/projects/autocomplete/ fails with a 406 error ("406 Not Acceptable").
Other pages (/projects/autocomplete/issues/, /projects/autocomplete/news, ...) work without error.
Relevant logs :
mars 23 19:33:01 puma[2142027]: I, [2026-03-23T19:33:01.136871 #2142027] INFO -- : [42168f4a-0ece-439f-b708-93f442edda1a] Started GET "/projects/autocomplete/" for 127.0.0.1 at 2026-03-23 19:33:01 +0100 mars 23 19:33:01 puma[2142027]: I, [2026-03-23T19:33:01.137804 #2142027] INFO -- : [42168f4a-0ece-439f-b708-93f442edda1a] Processing by ProjectsController#autocomplete as HTML mars 23 19:33:01 puma[2142027]: I, [2026-03-23T19:33:01.159232 #2142027] INFO -- : [42168f4a-0ece-439f-b708-93f442edda1a] Current user: test1 (id=4) mars 23 19:33:01 puma[2142027]: I, [2026-03-23T19:33:01.160136 #2142027] INFO -- : [42168f4a-0ece-439f-b708-93f442edda1a] Completed 406 Not Acceptable in 22ms (ActiveRecord: 7.4ms | Allocations: 5409) mars 23 19:33:01 puma[2142027]: F, [2026-03-23T19:33:01.160499 #2142027] FATAL -- : [42168f4a-0ece-439f-b708-93f442edda1a] mars 23 19:33:01 puma[2142027]: [42168f4a-0ece-439f-b708-93f442edda1a] ActionController::UnknownFormat (ActionController::UnknownFormat): mars 23 19:33:01 puma[2142027]: [42168f4a-0ece-439f-b708-93f442edda1a] mars 23 19:33:01 puma[2142027]: [42168f4a-0ece-439f-b708-93f442edda1a] app/controllers/projects_controller.rb:87:in `autocomplete' mars 23 19:33:01 puma[2142027]: [42168f4a-0ece-439f-b708-93f442edda1a] lib/redmine/sudo_mode.rb:61:in `sudo_mode'
Redmine version: 5.0.4-5+deb12u1 (installed via package from Debian repository on Debian Bookworm).
Database version: postgresql 17
Ruby version: 3.1
Files
Related issues
Updated by Go MAEDA about 1 month ago
- Related to Defect #3602: Project with the identifier of 'new' cannot be viewed added
Updated by Go MAEDA about 1 month ago
- File clipboard-202603261728-v05ie.png clipboard-202603261728-v05ie.png added
- File 43910.patch 43910.patch added
- Category changed from Project settings to Projects
- Target version set to Candidate for next minor release
Thank you for reporting the issue.
I wrote a patch for this issue. With this patch applied, autocomplete is treated as a reserved project identifier, so it is no longer possible to create a project with autocomplete as its identifier.
Currently, accessing /projects/autocomplete results in an error because it matches the existing projects#autocomplete route instead of the normal projects#show route. Because this identifier conflicts with an existing action, autocomplete cannot be used as a project identifier and therefore must be reserved.
Updated by Samuel Bizien Filippi about 1 month ago
Hello,
Thanks for your reactivity !
One of my colleague feared that bulk_destroy could also be a reserved word, based on his reading of https://www.redmine.org/projects/redmine/repository/svn/entry/branches/6.1-stable/config/routes.rb#L144 .
I was not able to test this.
Best regards,
Samuel.
Updated by Go MAEDA about 1 month ago
- File 43910-v2.patch 43910-v2.patch added
Samuel Bizien Filippi wrote in #note-4:
One of my colleague feared that bulk_destroy could also be a reserved word, based on his reading of https://www.redmine.org/projects/redmine/repository/svn/entry/branches/6.1-stable/config/routes.rb#L144 .
Thank you for pointing it out. I confirmed that Redmine returns a 404 Not Found error when deleting a project whose identifier is "bulk_destroy". This identifier should also be reserved.
Updated by Go MAEDA about 1 month ago
- File 43910-v3.patch 43910-v3.patch added
I changed the validation of the project identifier so that it runs only when a project is created or when its identifier is updated. Otherwise, it would no longer be possible to update the settings of existing projects that already have identifiers like "autocomplete" or "bulk_destroy".
Updated by Go MAEDA about 1 month ago
- Subject changed from Cannot see main page for my project named "autocomplete" (406 error) to Projects with the identifiers "autocomplete" or "bulk_destroy" cannot perform some operations
- Target version changed from Candidate for next minor release to 6.0.10
Setting the target version to 6.0.10.
Updated by Go MAEDA about 1 month ago
Committed the fix in r24549.
The project identifiers autocomplete and bulk_destroy have been added to the reserved identifiers list, in addition to the existing reserved identifier new. As a result, users can no longer create projects with the identifiers autocomplete, bulk_destroy, or new.
This change does not affect existing projects that already use autocomplete or bulk_destroy as their identifier. It also does not fix the problems those projects already have with some operations, such as viewing the Overview page for an autocomplete project or deleting a bulk_destroy project.
Updated by Go MAEDA about 1 month ago
- Status changed from Confirmed to Resolved
- Assignee set to Go MAEDA
Updated by Go MAEDA about 1 month ago
- Status changed from Resolved to Closed
- Resolution set to Fixed
Merged the fix into the stable branches in r24553 and r24554.